Finish the operator runbook

The runbook names key fingerprints and procedures but never embeds private keys, tokens, or passphrases. This is a small part of a safe operator path from a local machine to a disposable Ubuntu server, including file transfer, tunnels, automation, and recovery, but the boundary it creates affects everything that follows.

Access is reliable when another authorized operator can follow a tested runbook without inheriting secret material. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to write only the happy-path ssh command and call the system maintained. It makes later failures harder to locate. Instead, record prerequisites, trust verification, expected evidence, rollback, revocation, and recovery for every operation. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Operate SSH access over time with narrow automation, regular rotation, revocation, and rehearsed recovery. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Rebuild the disposable server and have a second operator restore safe access from the runbook. Hand the result to someone else and see whether the behavior is clear without an oral explanation.